Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-58458

In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Published

2025-09-03T15:15:39.520

Last Modified

2025-09-08T17:14:19.823

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-200
    CWE-538
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application jenkins git_client ≤ 6.1.3 Yes
Application jenkins git_client ≤ 6.3.2 Yes
Application jenkins git_client 6.2.0 Yes
References